Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 8

Vulnerabilities 11

• High 7.5
  CVE-2025-59465

  A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unh…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jan 20, 2026
• High 7.1
  CVE-2025-55130 Public exploit

  A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions …

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jan 20, 2026
• High 7.1
  CVE-2025-55131

  A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when usin…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jan 20, 2026
• Medium 6.5
  CVE-2025-59464

  A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freei…

  Node.js node nodejs nodejs-20 Ubuntu Wolfi
  Jan 20, 2026
• Medium 6.5
  CVE-2026-45149

  brace-expansion: Large numeric range defeats documented `max` DoS protection

  The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop …

  juliangruber brace-expansion langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  May 29, 2026
• Medium 5.9
  CVE-2025-59466

  We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable w…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jan 20, 2026
• Medium 5.9
  CVE-2026-21637

  A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCal…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jan 20, 2026
• Medium 5.9
  CVE-2026-21717 Public exploit

  A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash co…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 30, 2026
• Medium 5.8
  CVE-2026-21636 Public exploit

  A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `-…

  Node.js node nodejs nodejs-20 Ubuntu Wolfi
  Jan 20, 2026
• Low 3.3
  CVE-2026-21716

  An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without t…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 30, 2026
• Low 2.8
  CVE-2025-55132

  A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` e…

  Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jan 20, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-21637
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-21636
• report
  https://access.redhat.com/security/cve/CVE-2025-59466
• report
  https://access.redhat.com/security/cve/CVE-2025-59465
• report
  https://access.redhat.com/security/cve/CVE-2025-59464
• report
  https://access.redhat.com/security/cve/CVE-2025-55132
• report
  https://access.redhat.com/security/cve/CVE-2025-55131
• report
  https://access.redhat.com/security/cve/CVE-2025-55130
• report
  https://access.redhat.com/security/cve/CVE-2026-21717
• report
  https://access.redhat.com/security/cve/CVE-2026-21716
• report
  https://access.redhat.com/security/cve/CVE-2026-45149
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7387.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2431352
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-55130
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-55130
• article
  https://nodejs.org/en/blog/vulnerability/december-2025-security-releases
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2431350
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-55131
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-55131
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2431338
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-55132
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-55132
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2431344
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-59464
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-59464
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2431349
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-59465
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-59465
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2431343
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-59466
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-59466
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2431342
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-21636
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-21636
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2431340
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-21637
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-21637